Imperceptible Adversarial Attacks On Neural Network Classifiers For 3D Point Clouds

3D point cloud classification neural network models are widely used in many fields,including object recognition,autonomous driving,and robot navigation,where the security of the models is required.However,existing studies have shown that neural network models are at risk of adversarial attacks^[12].The study of adversarial attack methods for 3D point cloud classification neural network models is important to improve the security and robustness of neural network models.Most of the existing attack methods against 3D point cloud classification neural network models do not take into account the geometric properties of point clouds,resulting in the generated adversarial samples being easily perceived.To address the above problems,this paper investigates the imperceptible adversarial attack method for3D point cloud classification neural network models by combining the geometric properties of point cloud surfaces such as normals,tangents and curvatures.The experimental part verifies that the attack method in this paper has better imperceptibility while achieving 100%attack success rate using three representative DNN architectures（Point Net++,DGCNN,Point Conv）on two publicly available datasets Model Net40^[62]and Shape Net Part^[63].Specifically,the main work of this paper is as follows:（1）In response to the traditional attack methods that do not consider the geometric properties of point clouds,resulting in the generation of adversarial samples that are easily perceived,this paper proposes new directional perturbation attack methods that combine the normal and tangent directions of point clouds:normal direction attack（NA）and tangent direction attack（TA）.In the process of iterative optimization,the projection distance restriction is used to let the points perturb the underlying surface of the point cloud along the normal or tangential direction as much as possible.The adversarial samples generated in this way have less surface noise and significantly better imperceptibility than the traditional gradient attack method（GA）.（2）The curvature-aware module is designed to further investigate the attack effect of different perturbation directions in different curvature scenarios.The curvature of each point is calculated by combining the points in the neighboring region and the normal vector,and the forward curvature and reverse curvature are calculated according to the curvature size as the perturbation weights of GA,NA and TA,respectively,to achieve different sizes of perturbation applied to points with different curvature sizes,and to compare the attack performance of NA and TA under different curvature sizes.The results show that NA has better attack performance in the region with larger curvature and TA has better attack performance in the region with smaller curvature.（3）The joint attack framework NTA is proposed,which achieves the effect of adaptively selecting the perturbation direction according to the curvature size by designing a curvature adaptive module to generate more imperceptible adversarial samples.The curvature adaptive module automatically selects the perturbation along the normal direction for points with larger curvature and along the tangent direction for points with smaller curvature according to the curvature magnitude in the process of attack,combined with the curvature weights.The results show that NTA can provide higher attack success rate and better visualization results without sacrificing imperceptibility.